CVE-2026-104393
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
Stored XSS vulnerability in the Happy Addons for Elementor plugin by weDevs. Improper input neutralization during page generation allows persistent execution of malicious scripts.
Risk Assessment
An attacker can inject a malicious script that executes in the context of an authenticated administrator, potentially leading to data theft, session hijacking, or content modification.
Recommendation
Update the Happy Addons for Elementor plugin to a version newer than 3.50.0 if a patch is available. Restrict permissions for users who can input content.
Other vulnerabilities in Happy Addons for Elementor
See all- CVE-2026-62080Medium
Happy Addons for Elementor plugin version 3.23.1 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by contributors, allowing injection of malicious scripts.
- CVE-2025-63077Medium
The Happy Addons for Elementor plugin (versions up to and including 3.20.3) contains a Missing Authorization vulnerability due to incorrectly configured access control security levels. This may allow unauthorized access to functions or data.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Stored XSS.This issue affects Happy Addons for Elementor: from n/a through 3.50.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS